Overview

overview

10

Static

static

10

0cac94b343...68.exe

windows7_x64

10

0cac94b343...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cac94b343009d43b2d01b991e7e3ffe27094507d90880caed05610fb18f5568

  • Size

    101KB

  • Sample

    220212-jl5p1abcek

  • MD5

    7d288a2605aea21b43120f84db4ae904

  • SHA1

    7bac17f5729ff2f579a46cf68a2050586f61bf81

  • SHA256

    0cac94b343009d43b2d01b991e7e3ffe27094507d90880caed05610fb18f5568

  • SHA512

    ac680fd9a51429ec997ae546fcab9ccaa075de8f902914164f0288a0afcd4c8c517ab0a41624ac253f4e496338dc2a1d7d44c1f21c2900300b47170f91ce771e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0cac94b343009d43b2d01b991e7e3ffe27094507d90880caed05610fb18f5568

    • Size

      101KB

    • MD5

      7d288a2605aea21b43120f84db4ae904

    • SHA1

      7bac17f5729ff2f579a46cf68a2050586f61bf81

    • SHA256

      0cac94b343009d43b2d01b991e7e3ffe27094507d90880caed05610fb18f5568

    • SHA512

      ac680fd9a51429ec997ae546fcab9ccaa075de8f902914164f0288a0afcd4c8c517ab0a41624ac253f4e496338dc2a1d7d44c1f21c2900300b47170f91ce771e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks